high7.5
CVE-2018-9850
In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parame…
Impact
In Gxlcms QY v1.0.0713, Lib\Lib\Action\Admin\DataAction.class.php allows remote attackers to delete any file via directory traversal sequences in the id parameter of an Admin-Data-del request.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Gxlcms | Gxlcms Qy | Version 1.0.0713 |